Help needed loading Securenet Expo HTs

cryptoman · Post by **cryptoman** » Wed Apr 23, 2003 4:02 pm

I have some Motorola Expo HT's which I believe to be equiped with some
type of Securenet encryption. They are two channel radios, with a channel
knob that has the open ( ) and (/) positions.

When listening to to a radio in the secure mode on a scanner, it sounds
like the white noise that occurs when the squelch is turned all the way
down.

I have a T3020AX key loader and a TKN8531B cable that connects it to the
Expo HT. When I try to load any of the HT's by pressing the "PTT" button
on the side of the KVL, the loader emits a series of beeps and displays
an error on the screen.

If anyone have any idea why I am not able to load the radios please let
me know!

The Expos are:
Model: H33BXU3120AN
FCC ID: AZ489FT3631

-Cryptoman

hfitzgerald · Post by **hfitzgerald** » Sun Apr 27, 2003 11:11 am

The part number you listed is for a DES Keyloader, -and I'm assuming that it came with the radios. (if not, you will want to make sure that you don't have DVP in your radios since these systems are not compatible)

Did you read the encryption primer on the Batlabs website? It has instructions on how to properly load a Keyloader and then load the key into a radio. (power on/off sequence, when to connect cables, how to operate, etc.)
http://www.batlabs.com/encrypt.html

Exerpt from the encryption primer:

To program a key into KVL:
1. Turn on the KVL
2. Press the LOAD button
3. It will prompt for the sequence number (0 to 7)
4. Press 0 for the first memory location
5. Prompt is 0.1 for the first set of octal or hex values
6. Press random values for the key, noting them on paper as you go
7. After 16 to 24 digits it won't take anymore digits (sometimes the last digit will not take, try another if "E" shows)
8. Press ENTER button to save the key into loader
9. NOTE The KEY # is NOT retrievable from the loader

To program key into radio:
1. Connect radio to KVL with appropriate cable
2. Turn on the radio
3. Turn on the KVL
4. Press the PTT (push-to-transfer) on KVL
At this point, the KVL will send the encryption key to the radio. It only takes a split second. The KVL will now send a 1000hz encrypted tone to the radio, and if all is successful, you'll hear the tone from the speaker. On some of the KVL's, there is a signal sent back from radio to KVL and it will display "PASS" for "FAIL" on the display. Other's will display "BEEP" only as a reminder to make sure the decrypted tone was present in the radio.

The key inside the radio is volatile, meaning that if you disconnect the battery while the radio is on, the key is lost. If the radio is off and you disconnect the battery for more than about 30 seconds, the key will be lost.

I'm curious, does your radio have a rotary 4-position knob for the channel selector? -This would allow you to use channel 1 in Open or Secure mode, and channel 2 in Open or Secure mode. (or is it simply a Secure mode on/off switch)

Give us a reply if this works or fails. God bless,
Fitz Fitzgerald.

cryptoman · Post by **cryptoman** » Tue Apr 29, 2003 11:17 am

Fitz,

Thanks for your reply to my posting.

I have read all of the info on Motorola encryption that I could
find on Batlabs as well as the Internet in general, but didn't
come across much on Expo radios.

The radios were obtained separately from the KVL. I don't have any
info on the type of encryption that the radios have, or even if they
have Securenet modules installed. Can anyone tell me how to
identify such a module? I can open one of the radios up and take
a look.

The radios are the type that you mentioned. They are two channel
with a four position selector switch that can select either channel
in clear or secure mode.

When I transmit in the secure mode, I can hear what sounds like an
encrypted signal on a scanner, just white noise hiss. If there is
no Securenet module in the radio, would it act like this, or should
there be no signal at all picked up on a receiver?

-Cryptoman

1 Adam 12 · Post by **1 Adam 12** » Tue Apr 29, 2003 12:22 pm

Sounds like DVP, because DES radios of that era, would give you a high tone when you tried to key in secure and no key was loaded. DVP radios didn't do that

clavo · Post by **clavo** » Tue Apr 29, 2003 2:00 pm

Chances are you have a DES expo....i've never even seen a DVP expo and know most of the EXPO stuff is ex govt DES. With excrypted switch on....you key the radios and if a key is not loaded you hear "beep beep beep beep" fast and continous...

if a key is loaded you heard nothing ...and on another radio you will hear what sounds like white noise followed by a high pitched tone when you de-key....

in the clear switch mode you will hear one single beep on PTT .... alerting the user that he/she isn't in secure mode.

because you are hearing carrier and static you are transmitting in secure mode and DO have a loaded key.

if you want to try to kill the key...take the battery off and turn the radio off.... turn it back on and hold the monitor button on top the volume knob down.... that kills the key on the ones I have.

then you can transmit in secure and hear what it sounds like not to have a key loaded.

cryptoman · Post by **cryptoman** » Thu May 01, 2003 3:21 pm

I removed the battery from one of the Expo HT's and held down the monitor button after replacing the battery, but it still transmits
and encrypted signal as static hiss on a receiver. These radios had
been sitting arround for some time without charged batterys, so I
wouldn't expect any key to be loaded still.

This HT does send and receive fine when in the non-secure mode, and it does beep when the PTT transmit button is pressed when in
non-secure mode.

I opened up one of the Expo radios and checked it out inside. There are three accessory boards with the part numbers:

NTN4617A (top)
NTN4610A (middle)
NTN4615A (bottom)

I am hoping that one of these is some type of encryption board. If
anyone can tell me what type of boards these are it would be great.

I took some pictures of the inside of the radio that I might be able
to post if it would be helpful.

-Cryptoman

clavo · Post by **clavo** » Mon May 12, 2003 11:06 pm

you tried this: turn radio off, take battery off, turn radio back on holding down monitor button?

Thats what kills keys on my expos.

-c

seleong · Post by **seleong** » Mon Aug 04, 2003 8:12 am

I had some Expo radios that had some non-DES, non-DVP modules installed in them but they never transmitted coded transmissions while in secure mode. Please send me your e-mail address and maybe I can compare the modules in your radios to ones I have in my DES units.

Steve

Medic12 · Post by **Medic12** » Sat Aug 22, 2009 5:23 pm

Revive the dead.....

Can anyone confirm exactly what board is the DES board? I have NTN 4612A and NTN 4615A. I'd guess the 4615 is the DES. Anyone know 100% for sure?

-will

4n6inv · Post by **4n6inv** » Sun Aug 23, 2009 6:04 pm

I have a working VHF Expo that I play with for my four year old son. Mine is absolutely, psositively straight DES 173.6875 sx and 173.6750sx. If my memory serves me correctly (it's only been 10 years since I cracked it open) but the NTN4615A IS the DES board. I've never used anything but a T3011(C or D X) to load it with until I got my KVL3000 Plus with the triple DEs option. Works great; less filling... Actually a good little radio to tinker around with. You know how important it is to keep conversations secure between a four year old and a 49 year old... He actually knows when and where to turn the top switch when I say "Go to secure 1, 2, etc!" Just had to brag about my son. I got it at Dayton 12-15 years ago for $5.00 in a box full of "pot-luck-picks" Expos. It worked 100% when I bought a battery for it. END OF EXPO STORY.